Table of Contents

Configure Backend API Authentication

The backend API validates the access tokens used for authenticated RecroGrid Framework requests. Configure API-side authentication after the server runtime and data-access foundation are in place and before connecting the Blazor application.

Local development identity provider

For a new local development environment, use the Duende IdentityServer project provided in RGF.Demo.IDP. It provides a ready-to-run development identity provider for the configuration examples used by this guide.

The included configuration defines the values used throughout the local Server-side Application setup:

  • Authority: https://localhost:11900
  • Client ID: RGF.DemoApp
  • Client secret: rgf-demoapp-duende-secret
  • Blazor host redirect URI: https://localhost:44316/signin-oidc
  • API resource: api://RgfDemo.Api
  • API scope: api://RgfDemo.Api/API.Access

The final Run and Initialize the Solution step shows how to start RGF.Demo.IDP before the backend API and Blazor host.

Configure API-side authentication for RecroGrid Framework applications that use an OpenID Connect identity provider.

The API validates bearer tokens issued for the configured API resource. The client-side authentication flow depends on the selected application model and is documented separately under SessionAuth and Blazor WebAssembly Authentication.

JWT bearer package

Install the JWT bearer authentication package in the backend API application.

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

or with Package Manager:

Install-Package Microsoft.AspNetCore.Authentication.JwtBearer

Provider configuration

The current RecroGrid Framework application template selects the configured provider through JwtBearerOptions:Provider and binds the matching provider section to the ASP.NET Core JWT bearer options.

For local development, the example below uses the same identity-provider address as the RecroGrid Framework demo configuration.

"JwtBearerOptions": {
  "Provider": "Duende",
  "Duende": {
    "Authority": "https://localhost:11900", // Production example: https://identity.example.com
    "Audience": "api://RgfDemo.Api",
    "TokenValidationParameters": {
      "ValidTypes": [ "at+jwt" ]
    }
  },
  "AzureAD": {
    "Authority": "https://login.microsoftonline.com/{TENANT ID}/v2.0",
    "Audience": "{Application (client) ID}",
    "TokenValidationParameters": {
      "ValidTypes": [ "JWT" ]
    }
  }
}

Configure Microsoft Entra ID or Duende through the corresponding provider-specific section.

API registration

The current application template reads the selected provider and binds that provider section when registering JWT bearer authentication:

var provider = builder.Configuration.GetValue("JwtBearerOptions:Provider", "Duende");
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        builder.Configuration.Bind($"JwtBearerOptions:{provider}", options);
        options.TokenValidationParameters.SignatureValidator =
            (token, parameters) => new Microsoft.IdentityModel.JsonWebTokens.JsonWebToken(token);
    });

The API startup pipeline enables authentication before authorization:

app.UseAuthentication();
app.UseAuthorization();

Continue the complete solution workflow

With the backend API, database integration, and API authentication configured, the server-side foundation is ready for the browser-facing Blazor application.

Next step